United States General Accounting Office 


GAO 


Testimony 

Before the Subcommittee on National Security, Veterans 
Affairs, and International Relations, Committee on 
Government Reform, House of Representatives 


For Release on Delivery 
Expected at 10:00 a.m. 
Wednesday, 

September 20, 2000 


DOD PERSONNEL 

More Accurate Estimate of 
Overdue Security 
Clearance Reinvestigations 
Is Needed 


Statement of Carol R. Schuster, Associate Director 
National Security Preparedness Issues 
National Security and International Affairs Division 



DISTRIBUTION STATEMENT A 


Approved for Public Release 

Distribution Unlimited 


20000922 006 



GAO 

Accountability * Integrity * Reliability 




GAO/T-NSIAD-OO-246 





Mr. Chairman and Members of the Subcommittee: 


We are pleased to be here today to discuss our recent evaluation of the 
Department of Defense’s (DOD) backlog of overdue personnel security 
reinvestigations.* This evaluation was conducted at the request of the 
Subcommittee Chairman, who was concerned about the size of the 
backlog. In January 2000, DOD estimated that the backlog had grown to 
over 505,000, or about one out of every five individuals with a security 
clearance. However, DOD has also reported that it does not know the 
actual backlog size because existing personnel security databases cannot 
provide an accurate count of overdue reinvestigations. 

To lessen the government’s vulnerability to espionage and reduce national 
security risks, federal standards require a periodic reinvestigation of 
individuals with security clearances. An individual’s security clearance is 
outdated if a reinvestigation has not been initiated in the past 5 years for 
top secret clearances, 10 years for secret clearances, and 15 years for 
confidential clearances. Undertaking reinvestigations on time is 
particularly important because DOD regulations permit individuals to 
maintain access to classified information regardless of whether and how 
long their reinvestigations are overdue. 

Today, we will discuss (1) how DOD estimates the backlog, (2) the 
soundness of DOD’s backlog estimates, and (3) DOD’s plans to address the 
backlog problem. But first, we would like to provide a brief summary of 
our testimony. 


Summary 


In the absence of a Department-wide database that can accurately 
measure the reinvestigation backlog, DOD estimates the backlog on an ad- 
hoc basis. Since 1998, various DOD documents and statements have cited 
several widely divergent backlog estimates—ranging from about 452,000 
to 992,000. More recently, DOD has attempted to develop formal and more 
accurate estimates using two primary methods—manual counts and 
statistical sampling. Using the counting method, the military services and 
Defense agencies ask security managers to review their personnel and 
count those overdue for a reinvestigation. Using the sampling method. 


*DOI) Personnel: More Actions Needed to Address Backlog of Security Clearance Reinvestigations 
(GAO/NSIAD-00-215, Aug. 24, 2000). 
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DOD uses statistical analysis to refine rough—and known to be 
inaccurate—estimates extracted from existing security databases. 

However, the reliability of DOD’s recent formal backlog estimates is 
questionable because the estimates had methodological limitations, were 6 
or more months old by the time they were reported, and excluded 
thousands of overdue reinvestigations. For example, using the counting 
method, DOD reported in January 2000 that the backlog totaled about 
505,000. However, the military services used inconsistent methods and 
different time periods to determine their backlog counts, and DOD did not 
verify the accuracy of the counts. Using the sampling method, a DOD 
contractor reported in February 2000 that the backlog also totaled about 
505,000. However, only half of the individuals sampled responded to the 
survey, and the necessary follow-up was not performed to make the 
estimate statistically valid. Moreover, both estimates excluded as many as 
94,000 overdue reinvestigations that had been submitted for processing 
but were not yet completed as of February 2000. 

Knowing the accurate size of the backlog is an important step towards 
effectively managing and eventually eliminating the backlog. DOD 
recognizes this and plans to implement a new personnel security database 
in mid-2001 designed to include information that could allow real-time 
counts of overdue reinvestigations. However, DOD has not specified how 
it plans to use the information in the new database to help manage the 
reinvestigation program or ensure that future reinvestigation requests are 
submitted when they are due. Our August 2000 report recommended that 
DOD design routine reports that show the full extent of the backlog and 
that DOD develop incentives to keep reinvestigation information current 
and have requests for reinvestigations submitted on time. DOD agrees with 
these recommendations and has begun to implement them. 


Background 


The federal government uses personnel security investigations to 
determine whether an individual should be granted access to classified 
information. In addition to requiring an initial investigation, federal 
standards require periodic reinvestigations of individuals granted access 
to classified information. Although such investigations do not guarantee 
that individuals will not later engage in espionage activities, they remain a 
critical part of identifying those who can be trusted to access and 
safeguard classified information. Of the 2.4 million DOD military, civilian, 
and contractor employees with personnel security clearances at the end of 
fiscal year 1998, 96,000 held confidential clearances, 1.8 million held secret 
clearances, and 524,000 held top secret clearances. 
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The Assistant Secretary of Defense (Command, Control, Communications, 
and Intelligence) is responsible for DOD’s personnel security program, 
including the periodic reinvestigation program. The Assistant Secretary 
oversees the Defense Security Service, which is responsible for 
investigations and reinvestigations of DOD’s civilian and military 
personnel and contractors. Over 5,000 security managers within the 
services and Defense agencies are responsible for ensuring that 
individuals submit reinvestigation requests as their updates become due. 

DOD Regulation 5200.2-R, Personnel Security Program, states that a 
clearance shall not be suspended or downgraded solely because a periodic 
reinvestigation has not been conducted precisely within 5 years for top 
secret clearances and 10 years for secret clearances. The regulation 
requires that DOD agencies, in recognition of mission requirements, be 
flexible in administering the reinvestigation requirement. Thus, as a matter 
of practice, the services and DOD agencies normally do not suspend or 
downgrade individuals’ access to classified information when 
reinvestigations are overdue. 

Although DOD has historically reported a large backlog of overdue 
reinvestigations,2 the size of the backlog has reportedly increased 
significantly over the past few years due to several factors. First, new 
standards, approved in 1997, increased periodic reinvestigation 
requirements by shortening the time interval between reinvestigations for 
secret clearances from 15 to 10 years and by establishing a new, 15-year 
periodic reinvestigation requirement for confidential clearances. Second, 
for 4 years starting in fiscal year 1996, DOD tried to help the Defense 
Security Service clear up its backlog of pending investigations by imposing 
quotas on the number of reinvestigations the services and Defense 
agencies could request. This led to pent-up demand for reinvestigation 
requests. Finally, in October 1998, the Defense Security Service began 
having significant difficulties implementing a new automated case control 
management system. The problems led to reduced productivity and longer 
completion times. 


^The backlog can include overdue reinvestigations from the following DOD services and agencies: 
Army, Navy, Air Force, Marine Corps, Uniformed Services University of the Health Sciences, National 
Imagery and Mapping Agency. Defense Advanced Research Project Agency, Defense Information 
Systems Agency, Defense Threat Reduction Agency, Washington Headquarters Services, National 
Security Agency, Inspector General, Defense Logistics Agency, Defense Contract Audit Agency, 
Defense Finance and Accounting Service, Defense Security Service, Defense Intelligence Agency, Joint 
Staff, and DOD contractors. 
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Lack of Database Led 
DOD to Use Two 
Methods to Estimate 
Its Backlog 


DOD does not have a Department-wide information system to track the 
status of security clearances. Without a central database to help it 
determine the reinvestigation backlog, DOD has used two primary 
methods for ad-hoc estimates of the backlog—manual counts of 
individuals with overdue reinvestigations and statistical sampling 
techniques to refine rough estimates of overdue reinvestigations from 
existing databases. DOD’s primary existing database containing personnel 
security information, the Defense Clearance and Investigations Index, 
contains about 28 million records of past and current military, civilian, and 
contractor personnel who have been the subjects of criminal or security 
clearance investigations. Managed by the Defense Security Service, the 
index is used to study policy options and to prepare required and ad-hoc 
reports on the functioning of the personnel security program. Although the 
index was not designed to provide real-time, actual counts of overdue 
reinvestigations, it can provide a rough estimate of the backlog. The 
problem is that the rough estimate overstates the backlog because the 
index includes (1) many individuals no longer employed by DOD, (2) many 
individuals eligible for clearances but no longer requiring access to 
classified information, and (3) data showing only the highest eligible 
classification level of many individuals who currently require access only 
at a lower classification level. 


Reliability of DOD’s 
Backlog Estimates Is 
Questionable 


DOD’s two most recent backlog estimates—one by a DOD process team 
and the other by a contractor, the MITRE Corporation—were developed 
independently and used different estimating methods but coincidentally 
arrived at similar estimates of about 505,000 overdue reinvestigations. The 
process team’s estimate originated in November 1999, when the Deputy 
Secretary of Defense formed the team to review the accuracy of the 
reinvestigation backlog and develop solutions to manage and eliminate the 
backlog. To develop its backlog estimate, the team first defined the 
backlog and included only reinvestigations that were (1) overdue 
according to the time lapsed since the individual’s last investigation, 

(2) currently required, and (3) not yet submitted to the Defense Security 
Service for an update. Also, individuals with security clearances were 
evaluated according to the classified access level required to do their 
current jobs and not according to the highest level of classified access for 
which they were eligible. For example, an individual needing only a secret 
clearance but holding a top secret clearance was not considered overdue 
for a reinvestigation until 10 years, not 5 years, after the last investigation. 
The team then calculated its estimate by asking the services to count the 
number of individuals overdue for a reinvestigation. 
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The team’s estimate contained three key limitations that raise questions 
about the reliability of the estimate. First, the team did not review the 
methods used or the accuracy of the backlog counts reported by the 
services. Second, the services were inconsistent in the way they arrived at 
their counts and used different points in time to determine their backlog; 

• The Army asked its commands and units for a backlog count as of 
September 30,1999. 

• Navy leaders did not want to ask commands and units to count overdue 
reinvestigations, stating that this would disrupt mission responsibilities. 
Instead, the Navy (1) counted overdue reinvestigations of civilian 
personnel in one major command as of September 1999 and, on the basis 
of that count, extrapolated an estimate of its total civilian personnel 
backlog; (2) estimated its military personnel backlog by analyzing military 
jobs requiring clearances and the years of service of the individuals 
occupying those jobs (for example, individuals with over 6 years of service 
in jobs requiring a top secret clearance were considered overdue for a 
reinvestigation) ; and (3) used a count of overdue reinvestigations of 
civilian and military personnel in the Marine Corps as of September 10, 
1999. 

• Rather than performing another count of its backlog, the Air Force 
adjusted an April 1999 backlog estimate to approximate its backlog as of 
December 1999. To do this, the Air Force added all reinvestigation 
requests that it had submitted between May and December 1999 and 
subtracted them from its April 1999 estimate. The Air Force did not verify 
whether the requests subtracted from this estimate had been included in 
the original April 1999 estimate, and it did not add individuals that had 
become overdue for a reinvestigation from May through December 1999. 

The third limitation was that, rather than developing new backlog counts, 
the team used previously developed estimates of overdue reinvestigations 
among DOD agencies and contractors, even though these accounted for 
about one-third of the backlog. Finally, the team’s estimate used a 
definition of overdue reinvestigations that excluded those overdue 
reinvestigations submitted to but still pending at the Defense Security 
Service. Normally, the Defense Security Service does not open a 
reinvestigation immediately after it receives a request and usually requires 
about 5 to 7 months to complete a reinvestigation. When the team reported 
its estimate in January 2000, about 86,000 reinvestigations were still 
pending at the Defense Security Service; according to DOD officials, the 
vast majority of these were overdue. 
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DOD’s other recent backlog estimate—made by a contractor using 
statistical sampling—originated from a 1999 Defense Security Service 
study to measure the backlog and determine how the Service should 
prioritize backlog cases so that those with the highest security risk could 
be completed first.* As a starting point, the Defense Security Service 
obtained a rough, and known to be inaccurate, estimate of the 
reinvestigation backlog using existing databases. This estimate indicated 
that 954,445 individuals were overdue for reinvestigation as of June 30, 
1999. From this estimate, a random sample of 1,200 cases was taken. Each 
case was surveyed to determine whether it was a true backlog case— 
meaning that the individual held an active clearance, needed access to 
classified information at the clearance level indicated, and had no 
clearance update request in process. When the contractor wrote its report, 
it had received 617 survey responses (51 percent of the sample cases). Of 
these, 246 identified true backlog cases. 

The contractor’s estimate also included limitations that raise questions 
about its reliability. One was the low survey response rate. No survey 
follow-up was performed to increase the response rate, and because 
responses were fewer than 1,200, the estimate rested on the assumption 
that there were no statistical differences between respondents and 
nonrespondents. However, to determine whether this assumption was 
true, sampling and follow-up of nonrespondents were required; but neither 
was performed. 

Another key limitation of the contractor’s estimate was that, similarly to 
the process team’s estimate, it did not include all overdue reinvestigations. 
The estimate excluded overdue confidential reinvestigations, which 
number about 15,000, according to Defense Security Service officials. The 
estimate also excluded overdue reinvestigations pending at the Defense 
Security Service. In February 2000, when the contractor issued its report, 
about 94,000 reinvestigations were in process, and DOD officials stated 
that the vast majority of these were overdue. 

Other widely divergent backlog estimates have been cited in various DOD 
documents and statements in 1998 and 1999. However, these estimates 
cannot be compared either with each other or with the more recent 
estimates by the process team and the contractor because they included 


*The contractor’s study developed an algorithm to prioriti 2 e reinvestigation requests on the basis of 
security risk. By comparing historical data on clearance revocations with information submitted with 
each individual’s reinvestigation request, the algorithm predicts the likelihood that the individual’s 
clearance might be revoked. Defense Security Service officials stated that they plan to begin using the 
algorithm during summer 2000 to give priority to those reinvestigations considered the riskiest. 
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different clearance levels and were developed using different methods, 
time periods, and criteria for determining when an individual is overdue 
for a reinvestigation. Appendix I summarizes key data on reinvestigation 
backlog estimates by DOD and others. 


In a June 9,1999, memorandum, the Deputy Secretary of Defense directed 
the services and Defense agencies to eliminate the backlog by the end of 
fiscal year 2000 by ensuring that (1) all individuals had current clearances 
in accordance with national standards or (2) all requests for 
reinvestigation were submitted and in process. The memorandum also 
called for shifting some Defense Security Service workload to the Office of 
Personnel Management and to private investigative companies to expand 
DOD’s investigative capacity. The memorandum also stated that, contrary 
to established practice, clearances were to be administratively terminated 
or downgraded if they were not based upon a current investigation or 
were not in process for a reinvestigation by September 30, 2000. 

Although DOD shifted initial investigations and reinvestigations (except 
overseas investigations) of its civilian personnel to the Office of Personnel 
Management in 1999, the services and Defense agencies did not submit 
overdue reinvestigation requests at the rate required to eliminate the 
backlog by September 30, 2000. The services and Defense agencies had 
planned to submit 505,786 overdue reinvestigation requests (the same 
number estimated by the process team) in fiscal year 2000, plus 131,000 
that were becoming due. DOD analyses of the first 7 months of fiscal year 
2000 showed that the services and agencies submitted only about 
28 percent of the anticipated reinvestigation requests from October 1999 
through April 2000. This was only about 34,000 more than the number of 
reinvestigations expected to become due during this period, indicating 
only a modest drop—about 7 percent—in overdue reinvestigations not 
submitted for update. To meet the goal of eliminating the entire backlog by 
September 30, 2000, the backlog should have been reduced by over 
50 percent (about 250,000) by the end of April. 

According to DOD officials, the services and Defense agencies did not 
submit more overdue reinvestigations primarily because they had not 
budgeted the additional funds needed to cover the costs of the increased 
workload and did not shift funds from other programs. Recognizing the 
problem, subsequent DOD memorandums issued on March 31, 2000, and 
June 22, 2000, 

• extended the deadline for eliminating the backlog to March 31, 2002 (now 
extended to September 30, 2002); 


DOD Is Taking Steps 
to Address the 
Backlog 
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• directed that all secret and confidential Initial investigations and 
reinvestigations of military personnel be transferred to the Office of 
Personnel Management to further reduce the Defense Security Service’s 
investigative workload;^ 

• estimated that an additional $201.6 million was needed to pay for work 
transferred to the Office of Personnel Management in fisc^ years 2001 and 
2002; and 

• directed the services and other components to (1) allocate funds from 
existing resources to pay for investigations performed by both the Defense 
Security Service and the Office of Personnel Management during fiscal 
year 2001 and (2) include all investigation funding that would be required 
for fiscal year 2002 in their budget submissions. 

Neither memorandum issued in 2000 stated that clearances would be 
cancelled or downgraded if reinvestigations were not current or in process 
by the new deadline. Thus, unlike the Deputy Secretary of Defense’s initial 
June 9, 1999, memorandum, they did not provide the same incentive urging 
security managers to submit future reinvestigation requests on time. 

DOD is also implementing a new personnel security database, the Joint 
Personnel Adjudication System, to consolidate its security clearance data 
systems and provide real-time input and retrieval of clearance-related 
information. Assuming that the data will be accurate and reliable, DOD 
officials stated, the system will be able to provide accurate information on 
the status of security clearances, including counts of overdue 
reinvestigations. With this capability, DOD should no longer need to 
expend resources to produce ad-hoc estimates of the backlog. The 
officials said, however, that they had not yet determined how and when 
the system’s periodic reinvestigation information will be extracted and 
used to monitor program performance. 


DOD Is Implementing 
Our 

Recommendations 


To improve the management of DOD’s personnel security reinvestigation 
program, we recommended that DOD (1) design routine reports with key 
data from the Joint Personnel Adjudication System database to show the 
full extent of overdue reinvestigations, including those overdue but not yet 
submitted for update and those in process, and (2) develop appropriate 


^The Defense Security Service would continue to perform overseas investigations, top secret initial 
investigations and reinvestigations of military personnel, and all investigations and reinvestigations of 
contractor personnel. 
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incentives to encourage agency security managers to keep information in 
the database current and to submit reinvestigation requests on time. DOD 
agreed with the contents of our report and our recommendations and 
stated that it would take steps to implement the recommendations. DOD 
stated, for example, that it would require that security clearances be 
downgraded or cancelled for those individuals who do not have a current 
clearance or who have not had the request for a periodic reinvestigation 
submitted to the Office of Personnel Management or the Defense Security 
Service by September 30, 2002. 

Mr. Chairman and Members of the Subcommittee, this concludes our 
formal statement. We will be happy to answer any questions you may have. 


Contact and 
Acknowledgments 
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Appendix I 


Estimates of DOD’s Periodic Reinvestigation 
Backlog 


Various entities have estimated the extent of the Department of Defense’s 
(DOD) periodic reinvestigation backlog, as shown in the following table. 
To determine whether an individual is overdue for a reinvestigation, DOD 
normally considers the reinvestigation interval standard for the clearance 
access level required to do the job. According to DOD officials, many 
individuals are eligible for a higher clearance than required to do the job. 
Existing databases always include the individual’s eligibility level, but they 
do not always include the individual’s required access level. The last 
column in the table shows which basis was used to determine the number 
of overdue investigations. 


Source of the estimate 

Estimated 
backlog size 

Clearance 

levels® 

Estimating 

method 

Backlog “as of” 
date 

Basis for determining 
overdue reinvestigations 


Process team'" 



Head count 

Sept./Dec. 1999 

Access 

MITRE'" 




June 1999 

Access 


ilH 




Sept. 1999 

Access, but eligibility was 
used for many individuals 

Joint Security Commission II 

73,160" 

TS 

Statistical 

survey 

Oct. 1998 

Access 

lUnrefined estimates |{ 

Defense Manpower Data 
Center for the Defense 
Security Service 

992,231 

TS, S, C 

Rough 

estimate/ 

existing 

databases 

June 1999 

Access, if information was 
in the database; otherwise 
eligibility 

Defense Manpower Data 
Center for the Assistant 
Secretary 

868,943' 

611,652= 

TS, S, C 

Rough 

estimate/ 

existing 

databases 

Oct. 1998 

Access, if information was 
in the database; otherwise 
eligibility 


Top secret (TS), including sensitive compartmented information. Secret (S). Confidential 
(C). 


'"Estimate made by Personnel Security Overarching Integrated Process Team. 

‘"Estimate made by the Defense Security Service and its contractor, the MITRE 
Corporation. 

‘The estimate was between 451,757 and 558,552 with a mean estimate of 505,155. 
The estimate was between 64,790 and 81,685 with a mean estimate of 73,160. 
'Based on lapsed time since last investigation date. 
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Appendix I 

Estimates of DOD’s Periodic Reinvestigation 
Backlog 


®Based on lapsed time since the individual’s case was adjudicated; that is, the date the 
decision was made to grant the clearance. 

Source: GAO analysis of data provided by DOD. 


(702095) 
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